| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.foreverfine .com domain |
rev 1 |
2025-08-19 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.lwebber .com domain |
rev 1 |
2025-08-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.lwebber .com domain |
rev 1 |
2025-08-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.winuklottery .com domain |
rev 1 |
2025-08-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.winuklottery .com domain |
rev 1 |
2025-08-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.foreverfine .com domain |
rev 1 |
2025-08-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.bratten .org domain |
rev 1 |
2025-08-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.lwebber .com domain |
rev 1 |
2025-08-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.foreverfine .com domain |
rev 1 |
2025-08-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bratten .org domain |
rev 1 |
2025-08-19 |
| sigma |
UNC4841 - Barracuda ESG Exploitation Indicators |
test |
2025-08-19 |
| sigma |
Python Image Load By Non-Python Process |
test |
2025-08-18 |
| sigma |
Potential Python DLL SideLoading |
test |
2025-08-18 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.thejaq .net domain |
rev 1 |
2025-08-17 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.thejaq .net domain |
rev 1 |
2025-08-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.thejaq .net domain |
rev 1 |
2025-08-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.thejaq .net domain |
rev 1 |
2025-08-17 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.alcapps .com domain |
rev 1 |
2025-08-16 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.alcapps .com domain |
rev 1 |
2025-08-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.alcapps .com domain |
rev 1 |
2025-08-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.alcapps .com domain |
rev 1 |
2025-08-16 |
| sigma |
Windows Event Log Access Tampering Via Registry |
experimental |
2025-08-16 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.luxflow .net domain |
rev 1 |
2025-08-15 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.luxflow .net domain |
rev 1 |
2025-08-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.luxflow .net domain |
rev 1 |
2025-08-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.luxflow .net domain |
rev 1 |
2025-08-15 |
| snort |
ET TROJAN Observed Spoofed WindowsPowerShell User-Agent |
rev 1 |
2025-08-14 |
| suricata |
ET MALWARE Observed Spoofed WindowsPowerShell User-Agent |
rev 1 |
2025-08-14 |
| snort |
ET TROJAN CastleLoader User-Agent Observed |
rev 1 |
2025-08-13 |
| suricata |
ET MALWARE CastleLoader User-Agent Observed |
rev 1 |
2025-08-13 |
| sigma |
Registry Modification Attempt Via VBScript |
experimental |
2025-08-13 |
| sigma |
Registry Modification Attempt Via VBScript - PowerShell |
experimental |
2025-08-13 |
| snort |
ET TROJAN Synapse/Lambda Ransomware CnC Checkin |
rev 2 |
2025-08-12 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.mikealesso .com domain |
rev 1 |
2025-08-12 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.giftofappetite .com domain |
rev 1 |
2025-08-12 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.mikealesso .com domain |
rev 1 |
2025-08-12 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.giftofappetite .com domain |
rev 1 |
2025-08-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.giftofappetite .com domain |
rev 1 |
2025-08-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.mikealesso .com domain |
rev 1 |
2025-08-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.mikealesso .com domain |
rev 1 |
2025-08-12 |